Journalists, lawyers and activists beware – the state can watch what you are doing on your computer. We all know that the state can monitor our phone calls, faxes, internet usage, travel movements, financial transactions and soon our health records too. But what about when we put pen to paper, or rather fingers on the keyboard?

In June 2008 the German Interior Ministry announced plans[pdf] to amend its laws to allow the police to conduct "remote searches of computer hard drives" using Rootkits or remote forensic software, covertly placed in a computer to monitor its content. The German law was later passed with strict conditions that it was to be used only in cases of terrorist threat and that searches had to be authorised by a judge.

This signalled that state agencies now have the technological capacity to remotely access any computer and begged the question, which other countries are also using this highly intrusive surveillance technique and for what purposes?

In July 2008 the EU Council presidency sent out a note[pdf] on a "comprehensive plan to combat cyber-crime" saying "common approaches" (code for new laws) were needed for "projects already in existence". These projects included: "the area of remote computer searches, which is a delicate issue because of their cross-border nature."

Plans to allow remote access to computer hard drives next surfaced at the September meeting of the shadowy G6 Interior Ministers group (Germany, France, Italy, Poland, Spain and the UK) in Bonn, where they were joined by the US secretary of homeland security. The G6 conclusions noted[pdf] that: "almost all partner countries have or intend to have in the near future national laws allowing access to computer hard drives and other data storage devices located on their territory. However, the legal framework with respect to transnational searches of such devices is not well-developed."

If "almost all" intend to introduce laws allowing remote access, this means they all have the technological capacity, how many are already carrying out these searches? We are told that the legal framework for "transnational searches" is not well-developed – shorthand for nonexistent. As the US secretary for homeland security was sitting at the table, it might reasonably be assumed that US agencies also have this technological capability. This leads to an obvious conclusion, if an Italian security agency can remotely access a computer hard drive in Spain, then US agencies can remotely access any computer in the EU.

Back in the EU, draft council conclusions[pdf] in October 2008 on cyber-crime included "measures to facilitate remote computer searches, allowing investigators rapid access to data". There was no longer any mention of the "delicate issue" of "cross-border" searches. In November 2008 the council of justice and home affairs ministers formally adopted council conclusions[pdf] (policy statements).

The conclusions are not limited to terrorism and child pornography – for which the technology was developed – but cover all crimes however minor. As long as remote computer searches are "provided for under national law" and are carried out "with the agreement of the host country" its acceptable and simply requires a nod from a target's home country for the unlimited gathering of professional and personal intelligence. However this limitation only applies to police, immigration and customs and not to the security and intelligence agencies who have no such constraints at all placed on them.

This is a classic case of function creep; having developed a technology for specific purposes, state agencies seek to extend its use to a whole range of suspects. Individuals and groups will not know they are being spied on. The arguments being prepared by lawyers working on contentious cases, journalists seeking to expose abuse and unlawful practices or protest groups planning a demonstration could all be targets.